Public bug reported: [Summary] Writing to a VirtualBox shared folder (vboxsf) from pages that have not been faulted in makes the in-kernel vboxsf driver loop forever: the target file keeps growing with zeroed data until the disk is full, the writing process only dies on SIGKILL, and the log fills up with
WARNING: lib/iov_iter.c:624 at iov_iter_revert+0x1fc/0x270 In my case ~16 GB of logs were written before the guest ran out of space. [Root cause] vboxsf_write_end() ignores "copied": it writes the full requested length to the host and returns that length even when copied == 0, so generic_perform_write() never faults the source pages in, advances pos and loops forever. The same accounting bug can silently corrupt data when the folio is already uptodate. [Upstream] Patch submitted to the vboxsf maintainer and linux-fsdevel on 2026-09-19: https://lore.kernel.org/linux-fsdevel/[email protected]/ A DKMS package with the patch (and a guard that refuses to mount shared folders unless the patched module is loaded) is available at https://github.com/kentaro-shiomi/virtualbox-vboxsf-endless-write-loop-fix [Trigger] Programs that write straight from an mmap of another file or from shared memory without reading it first. virtiofsd does exactly this, so running a nested VM whose working directory lives on a vboxsf mount hits it immediately. Ordinary applications write from buffers they have just filled and are not affected. [Environment] Ubuntu 26.04.1, kernel 7.0.0-31-generic, guest of VirtualBox 7.2.16 on a Windows 11 host. The faulty code is identical in Linux v7.0 and in master as of 2026-09. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: patch-available vboxsf virtualbox -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167772 Title: vboxsf: endless write loop and data corruption on short copy To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167772/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
